DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Description
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Analysis
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Sqlite | Sqlite | 85% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Remediation
No vendor fix or workaround currently provided.
OpenCVE Recommended Actions
- Apply the latest SQLite release (3.42 or newer) that removes the use‑after‑free bug.
- If an immediate upgrade is impractical, ensure that any ORDER BY clause constructed from user input is first validated to guarantee that the list contains a safe, bounded number of items; reject or sanitize clauses that exceed a sane limit.
- Add monitoring and alerting for SQLite crashes or abnormal memory access patterns to enable rapid incident response.
Generated by OpenCVE AI on July 30, 2026 at 02:13 UTC.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Fri, 31 Jul 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-416 | |
| Metrics |
ssvc
|
cvssV3_1
|
Fri, 31 Jul 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprList object via sqlite3ExprListDelete(), then attempts to access the nExpr member of the already freed object. This dangling pointer access causes invalid memory read operations. By constructing a malicious SQL statement containing an ORDER BY clause with a large number of items, a remote adversary can trigger this vulnerability. Successful exploitation can result in application crash (denial of service), leakage of sensitive memory contents, and under certain memory layout conditions, arbitrary code execution on the affected system. | DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. |
Wed, 29 Jul 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | sqlite: sqlite: Arbitrary code execution via malicious SQL statement | |
| Weaknesses | CWE-825 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Mon, 27 Jul 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-416 | |
| Metrics |
cvssV3_1
|
Mon, 27 Jul 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Sqlite
Sqlite sqlite |
|
| Vendors & Products |
Sqlite
Sqlite sqlite |
Mon, 27 Jul 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprList object via sqlite3ExprListDelete(), then attempts to access the nExpr member of the already freed object. This dangling pointer access causes invalid memory read operations. By constructing a malicious SQL statement containing an ORDER BY clause with a large number of items, a remote adversary can trigger this vulnerability. Successful exploitation can result in application crash (denial of service), leakage of sensitive memory contents, and under certain memory layout conditions, arbitrary code execution on the affected system. | |
| References |
|
MITRE
Status: REJECTED
Assigner: mitre
Published:
Updated: 2026-07-31T14:34:39.044Z
Reserved: 2026-06-07T00:00:00.000Z
Link: CVE-2026-51304
Vulnrichment
Updated:
NVD
Status : Rejected
Published: 2026-07-27T16:17:39.500
Modified: 2026-07-31T15:17:42.770
Link: CVE-2026-51304
Redhat
OpenCVE Enrichment
Updated: 2026-07-30T02:15:03Z
Weaknesses
-
CWE-825
Expired Pointer Dereference